3

So it looks like it is necessary to wrap a signed payload with "<Bytes>" "</Bytes>" before verifying its signature.

Some examples I have found are:

Offchain signature validation in NFTS pallet

Where it even shows the following comment

// NOTE: for security reasons modern UIs implicitly wrap the data requested to sign into
// <Bytes></Bytes>, that's why we support both wrapped and raw versions.

Again, the same wrapping found here

So my questions is, where can I find some documentation about this, or some historic explanation of why we need to do this ?. I get that this is how it has to be done, but I have not been able to find anything more about it.

Thanks for any answer beforehand!

1 Answer 1

5

If you don't wrap it with <Bytes> </Bytes>, a dapp could ask a user to sign a legit transaction instead of a random harmless payload.

In Ethereum, wallets that support the EIP-1271 standard will display the actual payload the user would need to sign. Without that standard, the only thing user will see is just the hex string.

So, wrapping with <Bytes> </Bytes> acts as a simple solution to avoid blind signing of forged transactions.

2
  • This is amazing info, very helpful! Do you have a link to any docs for this?
    – goastler
    Commented Aug 30, 2023 at 12:36
  • Unfortunately, I don't. Discovered this while going through various repositories. Commented Aug 31, 2023 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.